Fake IT support on Teams ends in certificates for admins, Microsoft says

Microsoft investigated two intrusions in which attackers posed as IT support in Microsoft Teams and talked users into granting remote access, mostly through Quick Assist. They then abused weak settings in Active Directory Certificate Services (AD CS) to get certificates for privileged accounts in one case and a domain controller in the other. No Teams flaw was involved, and Microsoft doesn’t name the attacker.

Both intrusions began with Teams messages and calls from people posing as support staff, from tenants named to look like the target organization. Once a user approved a remote session, the attacker dropped an archive and unpacked it into a new folder with a KB prefix in the user’s profile. A portable Python, Bun or Java runtime ran the code, which mapped the host and network and examined the certificate services.

In the first case, a certificate template let low-privileged requesters name another identity and get a certificate that signs in as it, a weakness known as ESC1. The attacker got certificates for three privileged accounts. About 90 minutes later, a second wave of Teams calls reached 16 users and yielded certificates for eight more. Within seconds of getting one, the attacker pulled directory data from a domain controller by replication, a technique called DCSync.

Microsoft Defender’s automatic attack disruption restricted the accounts and blocked more than 1,000 attempts to reach file shares. But one privileged account had been excluded from automated response. The attacker used it to reach a file server and copy data to an outside server with a renamed copy of the Rclone tool, SearchApp.exe.

In the second case, the attacker used PetitPotam to make a domain controller sign in to a system it controlled. It relayed that New Technology LAN Manager (NTLM) sign-in to the certificate services’ Web Enrollment pages, a weakness known as ESC8, and got a certificate for the domain controller. It used the certificate to get a Kerberos ticket as that machine. After Defender alerts, the customer isolated the workstation and Microsoft saw no further progress.

Microsoft says resetting a password or reimaging the first workstation doesn’t revoke a certificate already issued, or cancel Kerberos tickets already granted. Revoking a certificate doesn’t cancel those tickets either. Microsoft lists three file hashes from the intrusions and hunting queries for Microsoft Defender.